On Thu, 2007-08-30 at 14:40 -0400, James B Horwath wrote:
I recently upgraded to syslog-ng 2.0.4 running on a Red Hat AS release 4. I have the following on the system:
eventlog-0.2.5-1.i386.rpm eventlog-devel-0.2.5-1.i386.rpm libnet-devel-1.1.2.1-6.i386.rpm syslog-ng-2.0.4-1.i386.rpm
When I fire up syslog-ng I receive a large number of the following:
Aug 30 14:36:07:2007 syslogger1 syslog-ng[31079]: Error sending raw frame; error=\'libnet_write_raw_ipv4(): -1 bytes written (Message too long)\\x0a\' Aug 30 14:36:07:2007 syslogger1 syslog-ng[31079]: Error sending raw frame; error=\'libnet_write_raw_ipv4(): -1 bytes written (Message too long)\\x0a\' Aug 30 14:36:07:2007 syslogger1 syslog-ng[31079]: Error sending raw frame; error=\'libnet_write_raw_ipv4(): -1 bytes written (Message too long)\\x0a\'
I am trying to forward packets onto another log product, so I have spoof_source(yes) specified. What is the remedy for this error, am I loosing data?
spoof-source id disabled for these messages. The log message is probably larger than the MTU of your interface. Try to increase MTU with jumbo packets or limit incoming message size. -- Bazsi